write-incident-postmortem

To write an incident postmortem for a Sev-1 outage, input the system, incident ID, start and end times, severity, and impact summary to generate a structured document with an executive summary, timeline, root cause analysis, and remediation plan.

A blameless root cause analysis should include the immediate cause, contributing factors, and systemic issues. It reconstructs the timeline with decision points and evaluates the incident response to identify actionable prevention steps without assigning individual blame.

You generate remediation plans with owners and due dates by synthesizing the incident timeline and root cause analysis into actionable prevention steps, ensuring cross-reference updates link directly to relevant runbooks and architecture documentation.

Yes, you can use this structured postmortem format for systems beyond Sev-1 outages. While it applies to Sev-1 incidents, the structured sections like executive summary, RCA, and response evaluation capture learnings for any system failure.

The best way to document protective factors and response evaluation in a postmortem is to systematically review the actions taken during the incident timeline, capturing what mitigated impact and identifying systemic strengths alongside root causes.

Incident postmortems need cross-reference links to runbooks and past investigations to drive systemic improvements, maintain documentation linkage across architecture, and ensure remediation plans prevent recurrence by connecting to operational knowledge.